feat(governance): add hypatia-scan-reusable.yml — biggest LOC leverage of the reusable trilogy

Closes the four-PR reusable-workflow convergence campaign:
  #168 → #174 → #187 (mirror) → #190 (secret-scanner) → #192 (codeql)
  → this (#193 hypatia-scan).

Drift survey (gh api /search/code paginated over org:hyperpolymath,
blob-SHA grouped):
- 255 deployments
- 30 unique blob SHAs (11.8% drift — LOWEST of all 5 surveyed templates)
- Top 5 SHAs cover 213/255 (83.5%)
- Top SHA alone covers 100 repos (39.2%)

Feature variance: zero. Every sampled variant (top 7 + long-tail 10)
carries exactly one `scan` job; line counts range 207-416 but this is
pure propagation lag — older repos carry an earlier slimmer version of
the same monolithic job, newer repos carry the 413-416-line canonical.

Leverage: 416-line canonical × ~235 mechanical wrappers retired
≈ ~98,000 lines of duplicated workflow code removed estate-wide. This
is 5× the secret-scanner sweep (~19k) and 3× the mirror sweep (~35k).

Design: zero inputs except `runs-on`. The scan job body is byte-
identical to the canonical hypatia-scan.yml — no per-repo values to
parameterise; everything is `${{ github.* }}` / `${{ secrets.* }}`
which resolve in the caller context.

Caller MUST use `secrets: inherit` so GITHUB_TOKEN +
HYPATIA_DISPATCH_PAT flow through, AND grant `security-events: write`
+ `pull-requests: write` at the call-site permissions block (called
workflow permissions are capped by caller).

Per-call note: the long-tail 250-line variants (~25 repos) are older
versions of the same workflow, NOT customised. Standardize-up safely
in the wrapper sweep.

Author: hyperpolymath